Evidence of Russia-Linked Influence Operations in Africa
Total Page:16
File Type:pdf, Size:1020Kb
Evidence of Russia-Linked Influence Operations in Africa Shelby Grossman, Daniel Bush, and Renée DiResta Stanford Internet Observatory October 29, 2019 Contents 1 Executive Summary 2 2 Activities Targeting Libya 3 3 Activities Targeting Sudan 14 4 Activities Targeting Central African Republic 21 5 Activities Targeting Madagascar 33 6 Activities Targeting Mozambique 38 7 Activities Targeting Democratic Republic of Congo 42 8 Conclusion 53 9 Appendix: Links to Archived Pages 54 1 1 Executive Summary Russia’s global strategy for reasserting itself as a geopolitical superpower has led to an increased presence in Africa, where it has broadened efforts to shape the continent’s politics and pursue new economic opportunities to allay the effects of sanctions. While the presence of Russian military instructors and paramilitary groups in Libya and the Central African Republic is well documented, there is emerging evidence that Russian-linked companies are now active in the information space as well. Yevgeny Prigozhin, the oligarch perhaps best known for running the Internet Research Agency, is central to this expansion. In this post we identify a Facebook operation attributed to entities tied to Prigozhin – including, it appears, the Wagner Group, a Russian organization that has served as a private military contractor in several African countries. The first allusion to a social media influence operation tied to Prigozhin stemmed from Daily Beast reporting and a document shared with us by the Dossier Center that suggested the existence of a cluster of Facebook Pages tied to the Wagner Group. We identified an initial cluster of Pages which targeted Libya, and shared the find with the Facebook Threat Intel team. Facebook subsequently provided us with data on two related networks that they had been investigating previously. These networks have been tar- geting the Central African Republic, the Democratic Republic of the Congo, Madagascar, Mozambique, and Sudan, and included "news" Pages and web- sites, and Pages purporting to belong to political parties as well as a specific politician. The part of the operation we analyzed included 7 Instagram ac- counts and 73 Facebook Pages. 1.72 million people liked the Facebook Pages, though we note that some of these likes are possibly the same person across multiple Pages. The Page managers were quite active; in October 2019 alone there were 8,900 posts. 2 2 Activities Targeting Libya In September 2019 the Daily Beast reported that the Wagner Group had created Facebook Pages targeting Libyans. The Dossier Center shared with us the internal Wagner Group document that made this claim. The document stated that as of March 2019, "the company" (the word Wagner employees use to refer to their firm) had created 12 Libyan groups on Facebook that focused on 1) supporting Saif al-Islam Gaddafi, 2) news pages for the main regions of Libya, and 3) supporting Haftar. Wagner is a complex entity. Although presumed to be founded by Dmitri Utkin, a former lieutenant colonel in Russia’s special forces, there are vary- ing beliefs about ownership and control of the organization; some believe that it is less a mercenary organization than a semi-state force connected to Russia’s Main Intelligence Directorate (GRU). Wagner’s physical presence in Africa has been widely reported on, particularly in Sudan and Central African Republic. Its soldiers have also been deployed to protect political consultants sent to engage in election-related activities in support of preferred candidates in several countries, including Libya and Madagascar. Reports suggest that Wagner Group is supporting strongman Khalifa Haftar’s Libyan National Army militarily as he fights to seize Tripoli from an internationally recognized government. The Russian government has been supportive of Haftar, receiving him in Moscow and supplying his army with technicians to upgrade Soviet-era munitions. Our analysis of Pages targeting Libya provides one of the first known assessments of its apparent expansion into online social influence campaigns. Similar to its actions elsewhere in Africa – such as its involvement in Madagascar – the Wagner Group seems to be hedging its bets by supporting multiple candidates. The Pages we reviewed indicate, in support of prior reporting, that Russia is also supporting Saif al-Islam Gaddafi – Muammar Gaddafi’s son, and another possible presidential candidate. (For more back- ground on Libya, see the Internet Observatory’s scene setter from October 2, 2019.) All of the Pages had administrators in Egypt, along with at least one additional administrator in another country. 3 Figure 1: Wagner Group document shared by the Dossier Center Figure 2: Posting information for Libya Pages The document included an example post from a Page called ú¯@Y®Ë@ A J. JË ("Libya Gaddafi"). The post was a photo of Muammar Gaddafi, overlaid on an outline of Libya. The document described the post as a "Patriotic post about 4 the best time for the Motherland." We found the ú¯@Y®Ë@ A J. JË Page on Facebook. It was created on December 25, 2018 as a "Journalist" Page. It had five Page managers based in Egypt and one based in Italy. Its multiple daily posts typically shared older images of Gaddafi and memes featuring his son. Posts had moderate engagement, with a typical post receiving 100 to 300 likes and a handful of comments and shares. Figure 3: The "Libya Gaddafi" Page 2.1 Identifying and Assessing Other Pages We then identified 10 additional Pages that we attributed to the same opera- tional cluster. Facebook confirmed this attribution. This operational cluster is marked by the following characteristics: • All Pages had similar (in many cases identical) creation dates. Six of the Pages were created on December 25, 2018, two on December 30, 2018, two on January 20, 2019, and one on January 22, 2019. • All Pages but one listed "Journalist" in the About section. Ten of 11 About sections were otherwise empty; one Page ("Libya Forever") also 5 included the phrase "YK.CËA J. JË Q ªË@ A J. JË á £ñË@ A J. JËÐB@ A J. JË" ("Libya mother Libya, the homeland of Libya, the pride of Libya forever"). • There was a consistent administration pattern across the 11 Pages. For each Page, the majority of Page Managers (typically five to seven) were located in Egypt, and at least one additional manager was in another country, but no managers were in Libya – despite the fact that all claimed to be Libyan Pages. Two Pages, "Fezzan News Network" and "Libya News Network," had more than 14 Page Managers seemingly spread out across seven or more countries. • Approximately 200 posts were cross-posted verbatim across the cluster of Pages. • Suspicious follower growth marked by at least four surges in Page likes, on a timeline that was consistent across Pages. See Figure 5. • Consistent post timing and frequency. Most Pages posted at least twice a day, on most days. Libya Voice of Libya ●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●● ●●●●●●● ●●●●●●●●●●●●●●● ●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●● Tripoli News Network ●●●●●●● ●●●●●●●●●●● ● ●●●●●●●●●●●●●●●●●●● ●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●● Libyan National People ● ●●●●●●●● ●● ●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●● ●●●●●●●●●●●●●●●●●● ●●●●●●●● ●●●●● ●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●● Haftar Tripoli offensive Libya News Network ●●●● ● ● ●●●●●●● ●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●● ●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●● Libya Libya ●●●●●●●●●●●●● ●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●● Libya Gaddafi ●●●●●● ● ● ●●●● ● ●●●●●●●●●●●●●●●●●●●●●●●●●● ●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●● ●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●● Libya First ●● ● ●●● ●●●●●●●●●●●●●●●●●●●●● ●●●●●●●●●●●●●●●●● ●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●● ● Facebook Page Name Page Facebook Knights of Libya ●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●● ●●●●●●●● Fezzan News Network ●●● ●●● ●●● ●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●● ●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●● Falcons of the Conqueror ● ● ●●●●●● ●●●●●●●●●●●●●●●●●●●●●●●●●●●●● ●●●●●●●●●●●●●●●●●●●●●●● ●●●● ●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●● Cyrenaica News Network ●●● ● ●●●●●●●● ●●● ●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●●● Jan Apr Jul Oct Date of Post (2019) Figure 4: Frequency of posting across the 11 Facebook Pages. The Pages are remarkable for their high frequency of posting – in recent months, many Pages post about five times a day, sometimes with paragraphs of text and original memes. Source: CrowdTangle 6 Figure 5: Total number of individuals who liked each Page (as opposed to posts on a Page) from December 2018 through September 2019. We do not include "Libyan National People," "Falcons of the Conqueror," and "Voice of Libya" because data was unavailable for these three Pages The top line is "Libya Gaddafi." Source: CrowdTangle 2.2 Pro-Khalifa Haftar Pages Four of the Pages we reviewed supported Haftar. A J. JË àA Q¯ ("Knights of Libya") was unique in that it stopped posting in July. The other three were Bð@A J. JË ("Libya First" — the name and profile photo appear to be